.: BAD R.A.T. 1.4 :.
Released 16 years, 10 months ago. Aug 2005
By Mr Hawk::actions
Additional Details
- From: Germany
- Coded by: Mr Hawk
- Version: BAD R.A.T. 1.4
- Released date: Aug 2005, 16 years, 10 months ago.
- Coded in: Visual Basic
- Family: BAD R.A.T.
- Category: Remote Access
MegaSecurity Notes
Server: dropped files: c:\WINDOWS\keylog.dat Size: 6 bytes c:\WINDOWS\newserver.exe Size: 74,250 bytes port: 2323, 2324, 2325 TCP added to registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" data: 01, 00, 00, 00 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" data: 1 HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System "DisableCMD" data: 01, 00, 00, 00 tested on Windows XP August 02, 2005
Author Words
[New Version 1.4] |-[Bugs fixed] | |-Reg_del |-[Client] | |-Reg_change und Reg_new vereinfacht (Bessere Strucktur mit hex,dword,string) | |-MSConfig (Startups,Win.ini,System.ini,boot.ini) | |-Clientsetting: Reg Refresh |- [Server] | |-Mirco wird gepackt (mit ArithMetic_DMC), wird im Clienten wieder entpackt | |-Nochmals kleiner (ungepackt 232 KB) |-[Tests] | |-ArithMetic_DMC 28KB gepackt auf 7 KB = auf 25 % gepackt =75 % Packung! |-[Script] | |- Neues PHP-Notify-Script(nur noch eine Datei) | |- PHP-MySQL-Notify-Script- | |- CGI-Notify-Script Mr Hawk
URL's and mails were automatically redacted (filtered) for reader's safety. However the filter is not perfect and can't find all harmful elements. If you find something dangerous including file link, website, mail address, profanity... contact me immediately at sub7crew@protonmail.com, thank you in advance.